nanocore | 703bdf2ca62398c2a4530cb974068e3ecad0c293b336495b86991a40db946139

General

Target

b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
Size

837KB
MD5

26dafe289b4249ecff3cd945e81eeb99
SHA1

9b5e8adfede3c032cbfc91cf0d8c6b17c0971bed
SHA256

b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293
SHA512

03a98b486a225143c5b65509cd4606528cf52a3053422d031e6946e67e931d8f98e6a00995f8eaf946a2dbf7ed29cf48e10fbaf310d28257c0e75dd5f72182ba
SSDEEP

24576:sHYQwcFz4c9Vjw+jNN2R9x8TsFvfSki5ZmICdoHwJbQ:oF8cvjEosBVymIgJ

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

claude111.duckdns.org:31740

Mutex

0bcbe88e-f672-4ae9-8d88-8c69d7bd7e44

Attributes

activate_away_mode
true
backup_connection_host
claude111.duckdns.org
backup_dns_server
claude111.duckdns.org
buffer_size
65535
build_time
2022-12-25T22:39:01.788668536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
31740
default_group
march
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
0bcbe88e-f672-4ae9-8d88-8c69d7bd7e44
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
claude111.duckdns.org
primary_dns_server
claude111.duckdns.org
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

description	pid	process	target process
PID 1984 set thread context of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1704 schtasks.exe

pid	process
1704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exeb68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exepowershell.exe

pid	process
1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
512	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
512	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
1976	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

pid process

512 b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

pid	process
512	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exeb68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
Token: SeDebugPrivilege	512	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
Token: SeDebugPrivilege	1976	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

description	pid	process	target process
PID 1984 wrote to memory of 1976	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	powershell.exe
PID 1984 wrote to memory of 1976	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	powershell.exe
PID 1984 wrote to memory of 1976	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	powershell.exe
PID 1984 wrote to memory of 1976	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	powershell.exe
PID 1984 wrote to memory of 1704	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	schtasks.exe
PID 1984 wrote to memory of 1704	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	schtasks.exe
PID 1984 wrote to memory of 1704	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	schtasks.exe
PID 1984 wrote to memory of 1704	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	schtasks.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
PID 1984 wrote to memory of 512	1984	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe	b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe

C:\Users\Admin\AppData\Local\Temp\b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
"C:\Users\Admin\AppData\Local\Temp\b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GwbsWQvOjO.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GwbsWQvOjO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF596.tmp"
2⤵
- Creates scheduled task(s)
PID:1704

C:\Users\Admin\AppData\Local\Temp\b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe
"C:\Users\Admin\AppData\Local\Temp\b68d4952eaf5950f31cadf83a575f3d9ffd0f46b560a39abb3b013039fcb2293.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF596.tmp
Filesize
1KB

MD5
914bec2960714f04415440809566c15c

SHA1
17c4fd39001671ce694b56e521d13945ed868c4e

SHA256
321ac4af1e30abada0c6e900d9703ababb718d4389b6f0983752c49d8fa5e4af

SHA512
ce1219b865c853d9e26a597f8758c1506c590ae44ba733a07d0f2f334502b997f46da9e8e89d0a06e3862f065c6d7636abf7eac588b5b0b20277e054b7825e5c

Download Submit
memory/512-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/512-79-0x0000000004FF0000-0x0000000005030000-memory.dmp

Filesize
256KB

Download
memory/512-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/512-84-0x00000000004C0000-0x00000000004CA000-memory.dmp

Filesize
40KB

Download
memory/512-83-0x00000000005B0000-0x00000000005CE000-memory.dmp

Filesize
120KB

Download
memory/512-82-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/512-76-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/512-74-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/512-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/512-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/512-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/512-86-0x0000000004FF0000-0x0000000005030000-memory.dmp

Filesize
256KB

Download
memory/512-68-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1976-80-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/1976-85-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/1984-57-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1984-66-0x0000000004DB0000-0x0000000004DEC000-memory.dmp

Filesize
240KB

Download
memory/1984-65-0x0000000000520000-0x0000000000528000-memory.dmp

Filesize
32KB

Download
memory/1984-56-0x0000000000240000-0x0000000000260000-memory.dmp

Filesize
128KB

Download
memory/1984-55-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1984-59-0x00000000057F0000-0x00000000058A4000-memory.dmp

Filesize
720KB

Download
memory/1984-58-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/1984-54-0x0000000000F80000-0x0000000001056000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads